(no subject)

(no subject)

[Kirkwood, David A.]

[-- Attachment #1.1: Type: text/plain, Size: 276 bytes --]

How do I place a watch on files that are being rotated? For example: I
want to audit the audit logs themselves , and when they are rotated I
need to watch the new audit log that is created as well as the rotated
logs. 

 

Thanks,

 

David A. Kirkwood



 


[-- Attachment #1.2: Type: text/html, Size: 2124 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: watches on rotated files, was (no subject)

[Steve Grubb]

On Thursday 24 May 2007 10:03, Kirkwood, David A. wrote:
> How do I place a watch on files that are being rotated?

I suspect the files have to exist to place a watch on them. You can just touch 
them to create them empty. ausearch/aureport probably doesn't care. We are 
working on a directive to allow auditing a directory and its whole subtree 
for RHEL5 and 2.6.23. Al should be posting the code for review rsn.

-Steve